When you inherit an IT setup with no documentation, secure administrator access and backups first, then spend 90 days finding out what you have, fixing the riskiest gaps, and writing it all down. Do not start by changing things you do not understand: an unknown system you switch off may be the one that runs payroll.
It happens more often than people admit. The longtime IT person leaves, a provider relationship ends badly, or a company is acquired, and the new owner finds mystery passwords, a server nobody can explain, and subscriptions billing a card nobody recognizes. The plan below is written for the operations leader, office manager, or new IT hire who now has to make sense of it.
Key takeaways
- First 48 hours: confirm the company controls its admin accounts, domain, and backups.
- Inventory before you change anything. Most outages after a handover come from switching off things nobody understood.
- Fix the riskiest gaps first: unknown admin accounts, missing multi-factor authentication, untested backups, unsupported systems.
- Document as you go, so the next handover is the easy one.
The first 48 hours: secure the keys
- Admin accounts. List every global or super administrator in Microsoft 365 or Google Workspace. Make sure at least two company-controlled admins exist and both use multi-factor authentication.
- Domain and DNS. Find out where the domain is registered and in whose name. A domain in a former employee's personal account is an emergency.
- Backups. Confirm backups exist, see when they last ran, and who can reach them.
- Passwords. Collect whatever credentials exist into a company-owned password vault, and change any that a departed person knew.
- Vendors. Gather contacts for internet, phones, software, and any outside IT provider. If a provider is leaving, our MSP transition checklist lists what to ask for.
Days 1 to 30: find out what you have
Build an inventory before making changes:
- People and accounts: every user account, shared mailbox, and service account, and whether each still belongs to someone current.
- Devices: computers, servers, printers, phones, and network gear, with age and support status.
- Network: internet circuits, firewall, switches, Wi-Fi, and what is plugged in where. A rough diagram is fine to start.
- Cloud and software: every app the business pays for or relies on, who administers it, and when it renews.
- Data: where important files live and what is actually backed up.
- Contracts and licenses: terms, renewal dates, and who owns each license.
Expense reports and card statements are a fast way to find forgotten subscriptions.
Days 31 to 60: secure and stabilize
- Remove or disable admin accounts and users nobody can account for, after confirming nothing depends on them.
- Turn on multi-factor authentication for every account.
- Test a real restore from backup, not just a "job succeeded" message.
- Patch or plan replacement for unsupported systems.
- Review apps connected to Microsoft 365 or Google Workspace and remove the ones nobody uses.
- Set up basic monitoring so problems surface before staff report them.
Days 61 to 90: document and plan
- Turn the inventory into living documentation: network diagram, system list, vendor contacts, and how-to steps for common tasks.
- Create a renewal calendar for domains, certificates, licenses, and contracts.
- List the remaining risks and a 12-month plan to address them, with rough priorities.
- Score where you stand with our internal IT maturity assessment.
Red flags to look for
- Admin accounts with generic names or no owner.
- Shared logins, especially for administrator access.
- The domain, DNS, or a key subscription registered to a personal email address.
- No multi-factor authentication on email.
- Backups nobody has restored from, or backups stored on the same server they protect.
- Operating systems or firewalls that no longer get security updates.
- Remote access tools nobody remembers installing.
What this looks like in practice
When we first walked into a 35-person North Jersey medical lab, some computers had their cases open, and the "server" was a regular PC running Windows Home, kept alive by a fix-it guy. We documented what existed, then rebuilt it properly in two months: new machines, structured wiring, a real server, a new firewall, managed switches, and Wi-Fi across the office, lab, and warehouse. Three years later, when the company was acquired, every credential, diagram, and configuration was ready to hand over. Read the medical lab case study.
Should you do this yourself or get help?
A capable internal person can run most of this plan with time and a checklist. Bring in help when the environment is large, when you suspect a security incident, when critical systems have no working backup, or when nobody on staff can safely make administrator changes. If you are moving away from a provider at the same time, see how to switch MSPs without losing data.
How Compass can help
Compass helps New York and New Jersey businesses take control of inherited environments: we secure access, build the inventory and documentation, fix the urgent gaps, and leave your team a clear plan. We can stay on as senior support behind your staff, or hand it over cleanly when you are ready.
Frequently asked questions
What should I do first when I take over an IT environment?
Confirm the company controls its administrator accounts, domain, and backups, and change any passwords a departed person knew. Do this before changing anything else.
How do I document an existing IT environment?
Start with an inventory of accounts, devices, network equipment, cloud apps, data locations, and contracts. Then turn it into a network diagram, system list, vendor contacts, and simple how-to steps, and keep them current as you work.
What if the previous IT person will not hand over passwords?
Most cloud accounts and domains can be recovered through the vendor with proof of company ownership. Start with email and the domain, and document every recovery step.
How long does it take to stabilize an inherited IT setup?
For a small or mid-sized business, about 90 days covers securing access, building the inventory, fixing the biggest risks, and writing the documentation. Large or neglected environments take longer.
What are the biggest risks in an undocumented IT setup?
Unknown administrator accounts, missing multi-factor authentication, untested backups, unsupported systems, and key accounts registered to personal email addresses.
